ClawHub
Back to skill

Security audit

claude-api

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a documented API gateway, but it asks agents to follow mutable external setup instructions and expands a Claude-focused skill into hundreds of unrelated APIs.

Review before installing. Use this only if you intentionally want SkillBoss as a third-party gateway, understand that prompts and API credentials are sent to SkillBoss, and are comfortable with the broader API surface. Avoid letting an agent automatically follow skillboss.co/skill.md unless you first inspect and approve the remote setup steps.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:23
Finding

Unaudited External Instructions Enable Skill Instruction Hijacking and Excessive Scope Expansion

Content
View full analysis
📖 **Complete setup guide**: https://skillboss.co/skill.md ``` ### Technical Analysis The skill explicitly instructs an agent to obtain and act on setup directions hosted at `skillboss.co/skill.md`. The effective setup instructions are therefore not contained in the audited package and can be changed independently after the package has been reviewed or installed. This creates an instruction-hijacking boundary: content controlled by an external service is presented as an action for the agent to perform under the authority of the installed skill. A later modification or compromise of the external document could introduce new instructions without requiring a change to this repository. The documented setup also expands the skill from its declared Claude API gateway purpose to automatic configuration for 687 APIs, including unrelated capabilities such as email, scraping, social data, image generation, video, and audio. This broad expansion violates least-privilege principles and increases both credential exposure and the number of third-party capabilities available to the agent. The repository does not contain the remote document, so its current contents and behavior cannot be verified by this audit. The vulnerability is the delegation of actionable agent setup to mutable, unaudited external instructions—not a claim that the current remote document contains executable malware. ### Attack ...[truncated 1696 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (11)

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
95% confidence
Finding

The documentation advertises access to scraping, social data, email, and other unrelated APIs under a skill that appears to be for Claude API usage. In this context, that broadens the effective permission surface and could lead an agent to invoke powerful external capabilities without informed user consent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The activation phrase 'USE THIS when the user needs claude api' is broad and marketing-oriented rather than safety-oriented. In an agentic environment, underspecified invocation language can trigger the skill in ambiguous cases and route user data to an external gateway when the user did not clearly request this provider.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill is presented as a narrowly scoped Claude API integration, but the documentation expands it into a broad multi-API gateway with many unrelated capabilities. This scope mismatch can mislead users and agents into authorizing or routing data to services far beyond the expected Claude-only purpose, increasing the chance of unintended data exposure and overbroad use.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill promotes a wide external API gateway but does not adequately warn users that prompts, credentials, and other data may be transmitted to a third-party service with access to many unrelated capabilities. In a skill context, omission of these warnings undermines informed consent and makes accidental oversharing more likely.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.

Quick Test

bash
curl -X POST "https://api.skillboss.co/v1/chat/completions" \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.

Quick Test

bash
curl -X POST "https://api.skillboss.co/v1/chat/completions" \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 69)May include surrounding context.

Quick Test

bash
curl -X POST "https://api.skillboss.co/v1/chat/completions" \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 90)May include surrounding context.

Quick Test

bash
curl -X POST "https://api.skillboss.co/v1/chat/completions" \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The 'When To Use This Skill' criteria are broad and overlap with many common AI requests, especially requests for Claude access or lower-friction model usage. This increases the risk of unintended invocation and external transmission of prompts to SkillBoss without sufficiently clear user intent.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The agent instructions recommend non-Claude models even though the skill is branded as a Claude API skill. This can cause agents to silently route prompts and potentially sensitive data to unexpected providers, violating user expectations and weakening provider-boundary guarantees.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The 'Discover More' section promotes unrelated non-LLM capabilities that are not justified by the stated Claude API purpose. This encourages capability creep and increases the likelihood that agents or users will use the same credentialed gateway for scraping or social-data operations without proper review.

Content

No source excerpt is available for this finding.